Apple Sued Over Hide My Email Privacy Flaw

A California user has launched a proposed class action lawsuit against Apple, alleging the company misled customers about the effectiveness of its Hide My Email feature. The claim suggests that real email addresses can be exposed to anyone who knows how to look for them.

What Is Hide My Email?

Hide My Email is a feature available to iCloud+ subscribers, which is Apple’s paid cloud storage option starting at $0.99 per month. The concept is simple: instead of sharing your real email address with a website or app, you provide a randomly generated dummy address. Any messages sent to this dummy address get forwarded to your real inbox, keeping your actual email private.

Apple promotes this feature as a way to “keep your personal email address private,” making it a key part of iCloud+’s value since its introduction in 2021.

What the Lawsuit Claims

The complaint, filed in California, points out a major flaw in how Hide My Email operates. It claims that these randomly generated alias addresses can be reverse-looked-up, meaning anyone with the right tools could trace them back to the original account holder. Essentially, the anonymity that Apple promises might not truly exist.

The plaintiff argues that Apple was aware of this vulnerability or should have been, yet continued to advertise Hide My Email as a strong privacy feature. The lawsuit seeks class action status, allowing other affected iCloud+ users to join in.

The legal claims focus on consumer protection and false advertising under California law. As reported by 9to5Mac, the complaint specifically states that Apple misled customers regarding the actual level of privacy protection provided by the feature.

How the Flaw Works

Think of Hide My Email like a P.O. box for your inbox. You give out the P.O. box number instead of your home address, and mail gets forwarded to you. The lawsuit suggests that someone could look up that P.O. box number and potentially find your home address, which defeats the whole purpose.

The technical issue revolves around how Apple structures its alias addresses. According to CNET, this flaw means a real email address could be exposed to anyone who searches for it online, allowing companies, data brokers, or malicious actors to connect the dots between the alias and the individual behind it.

What This Means

If the lawsuit’s claims are proven, the impact on Hide My Email users could be significant. Many use this feature to sign up for services they don’t fully trust, like retail sites, newsletter subscriptions, and free trials, all without giving out their primary email address. If those aliases are traceable, users may have unknowingly left a paper trail.

This also raises concerns about what iCloud+ subscribers have actually been paying for. Hide My Email is a standout feature of the subscription. If it doesn’t function as advertised, there’s a notable gap between Apple’s marketing and reality.

As of now, Apple hasn’t commented on the lawsuit or confirmed any vulnerability. Until there’s an official response or a fix, iCloud+ users relying on Hide My Email for privacy may want to be cautious with their aliases.

Community Reaction

“I use Hide My Email for literally every signup I do. If companies can just reverse-lookup the alias to find my real address, what’s even the point?”

— Reddit user via r/apple

“Apple charges $1/month minimum partly on the promise of privacy features. If this flaw is real and they knew about it, that’s a really bad look.”

— YouTube comment on 9to5Mac’s coverage

What To Watch

• Apple’s official response: The company hasn’t yet addressed the lawsuit publicly. A statement or denial is likely to come in the next few weeks as legal proceedings unfold.
• Class action certification: For the lawsuit to proceed as a class action, a judge will need to certify it. This means the court has to determine if enough people were similarly affected to justify a group case. That process typically takes months.
• A potential fix: If the vulnerability is validated, Apple might release an update to change how Hide My Email aliases are generated or structured. Keep an eye out for mentions in future iOS or iCloud release notes.
• Regulatory interest: With increased scrutiny on Big Tech privacy claims in the U.S. and Europe, this case could attract attention beyond the courtroom.